Wait for confirmations before you call a deposit final
Zero-confirmation deposits can be reversed. A confirmations table with a per-coin threshold makes the wait explicit and the crediting safe.
Tagged “deposits”
8 entries
Derive deposit addresses from an xpub without a hot wallet
Give every user their own address while the private keys stay offline. The watch-only pattern, and why the gap limit matters.
Verify a Coinbase Commerce webhook
HMAC-SHA256 of the raw body against the X-CC-Webhook-Signature header, and the event types that actually mean money arrived.
Create a NOWPayments invoice and handle the callback
An API key on the way out, a signed and key-sorted JSON payload on the way back. The sorting requirement is the part that trips people.
Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Credit a deposit exactly once, however many callbacks arrive
A unique index on your own reference turns duplicate callbacks, browser refreshes and manual replays into no-ops instead of free balance.
Send a user to FaucetPay merchant checkout
An auto-submitting form POST with your own reference in the custom field — the field that makes the deposit traceable when it comes back.
Verify a FaucetPay merchant payment before crediting it
The callback from FaucetPay's merchant checkout is not proof of payment. Here is the server-side verify call, including the endpoint shape that quietly 404s if you get it wrong.